> While we can't stop anybody from tunneling, we should certainly aim
> to provide a binding that makes it cheap and easy for tunneling to
> be detected. To not do so would be to commit a major security
> faux pas.
Not at all. The faux pas is to assume that potentially dangerous
traffic is labelled. We should be encouraging proper security design,
which means the responsibility is at the receiving entity. The current
state of the art -- "gee I hope to heck nobody breaches my firewall" --
is cave-painting, not security.
/r$
--
Zolera Systems, Securing web services (XML, SOAP, Signatures,
Encryption)
http://www.zolera.com